White Paper: The controversial CLOUD Act

Executive Summary

The Cloud Act requires US companies to disclose data stored or processed outside the United States to authorised US authorities without a court order.

Companies located in Europe are also subject to the Cloud Act if they are a part of a US company or exchange data with US organisations.

The Cloud Act requires companies to not only disclose their own data, but also all data in their possession, custody or control, including customer data held by a cloud service provider.

It includes both personal and company data – from commercial information to trade secrets to intellectual property.

The US Cloud Act contradicts the EU General Data Protection Regulation (GDPR).

Companies in Europe run the risk of violating either the US Cloud Act or the GDPR.

Every European company should take a very critical look at the impact of the US CLOUD Act.

Only cloud providers with headquarters AND data centres in the EU offer maximum protection from the CLOUD Act and are GDPR-compliant.